CVEvulnerability

CVE-2015-1848

6.8 MEDIUM Published 2015-05-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-05-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-310

Description

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

Affected configurations

• fedora pacemaker configuration system (<= 0.9.137) • redhat enterprise linux high availability 6.0 • redhat enterprise linux high availability 7.0 • redhat enterprise linux high availability eus 6.6.z • redhat enterprise linux high availability eus 7.1 • redhat enterprise linux resilient storage 6.0 • redhat enterprise linux resilient storage 7.0 • redhat enterprise linux resilient storage eus 6.6.z • redhat enterprise linux resilient storage eus 7.1

Related

Weakness · not in database (1)

References